Stop the bleeding first, then document what happened
The moment you notice unauthorized transactions or activity on your bank account, call your bank's fraud line—not the number on your card, but the one on your statement or the bank's official website. Have your account number ready. Tell them you believe your account has been compromised. Most banks will freeze the account on the call, which stops new transactions when ready.
While on the phone, ask the bank to confirm which transactions were unauthorized. Write down the names of the fraud specialists you speak with, the times you called, and what they told you. This record matters later if disputes take weeks to resolve. Ask the bank to send you a written summary of the call—many will email it within hours.
Do not close the account yourself yet. Your bank may need it to remain open to investigate and reverse fraudulent charges. They will tell you when it is safe to close.
Key Takeaways
- Call your bank's fraud line when ready—not the customer service number—and have them freeze the account to stop new unauthorized transactions.
- The bank is responsible for reversing most fraudulent charges if you report them within 60 days, but you must report in writing within that window.
- Change your password from a different device (not the one that may be compromised) and enable two-factor authentication on your bank account and email.
- File a report with the Federal Trade Commission at IdentityTheft.gov, which creates an official record and gives you a recovery plan tailored to your situation.
- Monitor your credit reports for new accounts opened in your name, which may signal identity theft beyond the bank account itself.
Report the fraud in writing within 60 days
Your bank's fraud line will start an investigation, but you must also send a written dispute. This is the legal requirement under the Electronic Funds Transfer Act. Most banks accept disputes through their online banking portal, by email, or by mail. The important date is 60 days from the date the unauthorized transaction appeared on your statement.
In your written report, list each fraudulent transaction with the date, amount, and merchant name. State clearly that you did not authorize these charges. Keep a copy for your records. The bank has up to 10 business days to acknowledge receipt and up to 45 days to investigate and reverse the charges—though most resolve faster.
If the bank denies your dispute, ask why in writing. If you disagree with their decision, you can escalate to your bank's complaint department or file a complaint with the Consumer Financial Protection Bureau, which tracks patterns of fraud handling across banks.
find your devices and change your passwords
Your bank account was compromised somehow—either through a data breach at the bank itself, a breach at another company where you reused your password, or malware on your device. You need to assume your devices may be infected.
Change your bank password from a different device—a phone or computer that was not used to access the hacked account. Use a password that is unique to your bank and at least 16 characters long. Do the same for your email account, because email is the master key to resetting passwords everywhere else.
Enable two-factor authentication on both your bank account and email. This means the bank will send a code to your phone or email every time someone tries to log in from a new device. Even if a criminal has your password, they cannot get in without that code.
If you used the same password on other accounts, change those too. If you suspect malware, run a full antivirus scan on your computer and consider having a technician check it. For phones, restart the device in safe mode and run a malware scan, or back up your data and do a factory reset if you suspect serious infection.
File an identity theft report with the FTC
Go to IdentityTheft.gov and file a report. This is a free federal service that creates an official record of the theft. The FTC will generate a personalized recovery plan based on what happened to your account.
The report takes about 10 minutes and asks for details about the fraud—when you discovered it, what accounts were affected, and whether you know how the theft happened. You will receive a confirmation number and a recovery plan that lists specific steps for your situation, such as placing a fraud alert on your credit file or monitoring for new accounts.
Keep your confirmation number. If a debt collector later tries to collect on a fraudulent account, you can show them the FTC report to prove the debt is not yours.
Place a fraud alert and monitor your credit reports
A fraud alert tells credit bureaus to verify your identity before opening new accounts in your name. Contact one of the three major bureaus—Equifax, Experian, or TransUnion—and request a fraud alert. The bureau you contact will notify the other two automatically. The alert lasts one year and is free.
Order your credit reports from AnnualCreditReport.com, the only official source for free reports. You get one free report per bureau per year. Check them for accounts you did not open, inquiries from lenders you did not contact, or addresses that are not yours. If you find fraudulent accounts, dispute them directly with the credit bureau and the company that opened the account.
If the fraud is extensive—multiple accounts opened in your name—consider a credit freeze instead of an alert. A freeze prevents anyone, including you, from opening new accounts until you temporarily lift it. This is stronger protection but requires you to unfreeze before explore for credit yourself.
What your bank will and will not cover
Under federal law, your liability for unauthorized transactions depends on how quickly you report them. If you report within two business days of discovering the fraud, your liability is capped at $50. If you report between two and 60 days, your liability is capped at $500. If you wait longer than 60 days, you may be liable for the full amount.
Most banks are more generous than the law requires and will reverse fraudulent charges even if you report late, but you have no legal may provide. This is why the 60-day window matters—it is your important date to protect yourself.
The bank is not responsible for fraud that happens because you gave your password to someone, wrote it down where others could see it, or fell for a phishing email. If the bank can show you were negligent, they may deny your dispute. This is rare, but it is why you should never share your password or PIN with anyone, including bank employees.
Expect the investigation to take weeks, not days
Most banks complete fraud investigations within two to three weeks, but some take the full 45 days allowed by law. During this time, the fraudulent charges will likely remain on your statement. You are not responsible for paying them, but they may affect your available balance or credit score temporarily.
If you need access to your money while the account is frozen, ask your bank about a temporary replacement card or a transfer to a new account. Some banks will advance you the disputed amount while they investigate, though this is not required.
Once the investigation closes, the bank will send you a written decision. If they reverse the charges, the money will be returned to your account. If they deny your dispute, you can escalate or file a complaint with the Consumer Financial Protection Bureau.
Frequently Asked Questions
Can the bank make me wait 45 days to get my money back?
Yes, the bank has up to 45 days to investigate and reverse charges. However, many banks complete investigations faster, and some will credit your account temporarily while they investigate. Ask your bank what their timeline is and whether they can advance the disputed amount.
What if the hacker transferred money to another bank account?
Report it to your bank when ready. They will contact the receiving bank and ask them to freeze the account and return the funds. This process is slower than reversing a credit card charge—it can take weeks—but the receiving bank is usually required to cooperate. Your bank will guide you through this.
Do I need to file a police report?
Not required, but it can help. If the fraud is extensive or involves identity theft beyond your bank account, a police report creates an official record that you can show to creditors and credit bureaus. Call your local police non-emergency line or file a report online through your city's website.
Will this affect my credit score?
Fraudulent charges themselves do not hurt your credit score because they are not legitimate debt. However, if the hacker opened new accounts in your name and those accounts went unpaid, those will damage your score. This is why monitoring your credit reports is important—you need to dispute fraudulent accounts quickly.
What if my bank denies my dispute?
Ask the bank in writing why they denied it. If you disagree, you can file a complaint with the Consumer Financial Protection Bureau, which will investigate. You can also consult a consumer protection attorney, though most cases are resolved through the bank's dispute process.